Concerns with serde_yml

[evilpie]

@dtolnay raised issues with serde_yaml on twitter/X: https://x.com/davidtolnay/status/1883906113428676938.

[cafkafk]

Seems this is specifically the serde_yml crate https://github.com/sebastienrousseau/serde_yml, which yea... but I'm not sure this is an actual vulnerability as much as it's just the admittedly frustrating tendency for some projects not to do very thorough vetting of their dependencies.

[SkiFire13]

I don't know what can be done about the debatable management of the crate, but at least the emitter issue is objectively a soundness issue and can be reported, no?

[tarcieri]

Yes, you can file an informational = "unsound" advisory for it